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Abstract — A coding scheme based on irregular low-density 
parity-check (LDPC) codes is proposed to send secret messages 
from a source over the Gaussian wiretap channel to a destination 
in the presence of a wiretapper, with the restriction that the 
source can send only binary phase-shift keyed (BPSK) symbols. 
The secrecy performance of the proposed coding scheme is 
measured by the secret message rate through the wiretap channel 
as well as the equivocation rate about the message at the 
wiretapper. A code search procedure is suggested to obtain 
irregular LDPC codes that achieve good secrecy performance 
in such context. 

I. Introduction 

Physical-layer security provides secure communication be- 
tween desired users by taking advantages of various physical 
channel characteristics. The study of physical-layer security 
dates back to Wyner's seminal paper [1], in which he in- 
troduced the wiretap channel model. In a wiretap channel, 
a source tries to send secret information to a destination in 
the presence of a wiretapper. When the wiretapper channel 
is a degraded version of the destination channel, Wyner [1] 
described a code design based on group codes such that 
the source can transmit messages at a positive rate to the 
destination. This degradedness condition was removed in [2], 
which showed that a positive secrecy rate is possible for the 
case where the destination channel is "less noisy" than the 
wiretapper channel. Generalization of Wyner's work to the 
Gaussian wiretap channel was considered in [3]. In [4], a code 
design based on coset codes was suggested for the type-II 
(the destination channel is error free) binary erasure wiretap 
channel. Reference [5] considered the design of secure nested 
codes for type-II wiretap channels. Recently, references [6] 
and [7] concurrently established the result that polar codes [8] 
can achieve the secrecy capacity of the degraded binary-input 
symmetric-output (BISO) wiretap channels. 

Low-density parity-check (LDPC) codes have emerged as 
potential practical candidates for providing reliable and secure 
communication over wiretap channels. First, LDPC codes 
provide excellent "close-to-capacity" performance with rea- 
sonable encoding/decoding complexity [9], [10], [11]. Sec- 
ond, there exists powerful tools like density evolution [12] 
for asymptotic analysis and code design of LDPC codes. 
For example, the authors of [13] constructed LDPC based 
wiretap codes for the binary erasure channel (BEC) and the 
binary symmetric channel (BSC). In [14], multilevel cod- 
ing/multistage decoding using LDPC codes has been proposed 
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for the quasi-static Rayleigh fading wiretap channel. In [15], 
punctured LDPC codes were employed in a coding scheme 
that aims at reducing the security gap of the Gaussian wire- 
tap channel. In [16], further reductions in the security gap 
are achieved using non-systematic LDPC code obtained by 
scrambling the information bits prior to LDPC encoding. 

In this paper, we design LDPC codes for sending secret mes- 
sages over the Gaussian wiretap channel with binary phase- 
shift keyed (BPSK) source symbols. This work is inspired 
by the results in [17] on secret key agreement over the same 
wiretap channel, with the availability of an additional public 
feedback channel. In particular, Theorem 2 of [17] can be mod- 
ified to show the existence of regular LDPC code ensembles 
with increasing block lengths that achieve secrecy capacity [1], 
[3] of the BPSK-constrained Gaussian wiretap channel. Based 
on this observation, we propose a coding scheme which 
employs irregular LDPC codes [18] with finite block lengths to 
support practical secret transmission over the Gaussian wiretap 
channel. The proposed coding structure allows efficient design 
of irregular LDPC codes that give good secrecy performance 
as measured in terms of equivocation about the secret message 
at the wiretapper. This design constitutes the main technical 
contribution of the present paper. We note that codes suggested 
in [15] can be considered as unoptimized special cases of the 
proposed coding scheme. A more detailed comparison will be 
given in the sequel. 



The outline of the paper is as follows. Section II introduces 
the BPSK-constrained Gaussian wiretap channel. The pro- 



posed coding scheme will be discussed in detail in Section III 



In |Section YV\ we describe a code search algorithm based on 
density evolution analysis to obtain good irregular codes for 
use in the proposed coding scheme. Finally, conclusions are 
drawn in lSection VI 

II. BPSK-CONSTRAINED GAUSSIAN WIRETAP CHANNEL 

We consider the wiretap channel model in which the source 
tries to send a secret message to the destination via an additive 
white Gaussian noise (AWGN) channel in the presence of a 
wiretapper. The wiretapper intends to reconstruct the message 
by listening to the transmission through another independent 
AWGN channel. The secret message M <E {1,2- ■• ,2 fe } is 
encoded into a transmitted sequence X n — [X\, X2, • • • , X n ]. 
Let Y n and Z n denote the corresponding received sequences 
at the destination and wiretapper, respectively. We restrict the 
source to transmit only BPSK symbols, i.e. Xi € {±1}Q 

1 In later sections, whenever appropriate, we implicitly employ the mapping 
+ 1 — > and —1 — > 1, where and 1 are the two usual elements in GF(2). 



Then the BPSK-constrained Gaussian wiretap channel can be 
modeled as 

Y t = 0Xi + N t 
Zi=apXi + Ni, 

where A/, and TV, are independent and identically distributed 
(i.i.d.) zero-mean Gaussian random variables of variance a 2 . 
Note that j3 is the gain of the BPSK symbols transmit- 
ted by the source. We impose the source power constraint 

~Y%=i\ x j\ 2 < p such that P 2 < p > where p is the 

maximum power available to the source. Also, a is a positive 
constant that models the gain advantage of the wiretapper 
over the destination. Let the (noise) normalized gain be j3 — 
/3/ a, then the received signal-to-noise ratios (SNRs) at the 
destination and wiretapper are p 1 and a 2 j3 2 , respectively. 

Assuming a uniform message distribution, the rate of the 
secret message is R s = -. Let M denote the estimate 
of the message at the destination. The level of knowledge 
of the wiretapper possesses about the secret message can 
be quantified by the equivocation rate ^H(M\Z n ). A rate- 
equivocation pair (R s , R e ) is achievable if for all e > 0, there 
exists a rate-i? s code sequence such that 

1) Pr{M ^ M} < e, and 

2) R e < ±H(M\Z n ) + e 

for sufficiently large n. When the equivocation rate at the 
wiretapper is as large as the secret message rate, i.e. R s = R e , 
we say that the equivocation-rate pair is achievable with 
perfect secrecy [1]. The capacity-equivocation region of a 
wiretap channel contains all achievable rate-equivocation pairs 
(R s ,R e ). When a < 1, specializing the result in [2] shows 
that the capacity-equivocation region of the BPSK-constrained 
Gaussian wiretap channel is given by 



< R e < C h 



R e < R S <C 




where 



C0) - C{aj3) 
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and 



C(t) 



1 



log 2 (e- 2 ^) dy 



is the channel capacity of AWGN channel with BPSK input. 
The secrecy capacity of the wiretap channel is defined as 
the maximum secret message rate such that the condition 
of perfect secrecy is satisfied. For the BPSK-constrained 
Gaussian wiretap channel, the secrecy capacity is given by 
C b if a < 1. 

We note that Cb is achieved when Xi is equiprobable; 
but it is not necessarily achieved by transmitting at the 
maximum allowable power P. Fig. [Tj shows the plot of C&, 
in units of bits per (wiretap) channel use (bpcu), versus the 
maximum allowable SNR P/a 2 for a 2 = -1.0,-2.5,-4.4, 
and —4.7 dB, respectively. 




Fig. 1. The secrecy capacity Ci, of the BPSK-constrained Gaussian wiretap 
channel for different value of a 2 . 



III. Secret LDPC coding scheme 

In this section, we describe the proposed coding scheme 
for the BPSK-constrained Gaussian wiretap channel. Inspired 
by our previous work [17] on secret key agreement over the 
same wiretap channel, the proposed coding scheme employs 
irregular LDPC codes and its secrecy performance will be 
evaluated by measuring the equivocation rate of the secret 
message at the wiretapper. 

Similar to [17], we start with an (n, k) secret binary linear 
block code defined by the pair (C,W), where C is an (n, I) 
binary linear block code with 2 l distinct codewords of length 
n and W is an (I — k) -dimensional subspace in C. The ratios 
R r = — and JL = * will be referred to as the code rate 
and secret rate of (C,W), respectively. The pair (C,W) will 
be employed to support practical secret transmission over the 
wiretap channel. We take the following considerations into 
account when choosing (C, W). First, the choice of (C, W) 
should admit efficient encoder and decoder in order to make 
the proposed coding scheme practically implementable. Sec- 
ond, the choice of (C, W) should avoid transmitting the secret 
message M "directly" through the channel since such "direct" 
transmission is undesirable. Third, the choice of (C, W) should 
permit a design procedure based on which "good" codes can 
be obtained. 

To satisfy these considerations, we choose an (to, I) linear 
block code C from an ensemble of irregular LDPC codes, 
where m = n + k. Then the pair (C,W) is chosen as 
follows. Let H be the parity-check matrix associated with C 
and assume H — [A, B] where B is an (m — 1) X (to — I) 



where 



lower triangular matri?(P] Let X m — [c h ,d l k ,e m l ] 
e m-i = [ c k,d l - k ]A T (B- 1 ) T denote a codeword of C . Then 
the (n, I) linear block code C is chosen to be set of codewords 

2 This lower triangular matrix can be obtained through performing Gaussian 
elimination. If efficient encoding is necessary, an approximate lower triangular 
matrix as described in [11] can be used instead. 



obtained by removing c k from X m . That is, C is a punctured 
version of C . The subspace W is chosen to be the subset 
of (punctured) codewords obtained by setting c k to zero. The 
coding scheme employing the pair (C, W) is as follows: 

1) Encoding: The source sets c k to be the fc-bits se- 
cret message M and chooses S~ k randomly according 
to a uniform distribution. Then it calculates e m ~' = 



IV. Codes design and performance 



c k ,d l - k )A T {B' 1 ) T and sends X n = [d 



l-k 



i-Zl 



to 



the destination through the Gaussian wiretap channel. 
2) Decoding: The destination performs belief propagation 
(BP) decoding to decode X m using its channel observa- 
tion Y n . The first k bits of the decoded codeword give 
the estimate M of the secret message. 

We evaluate the secrecy performance of the proposed coding 
scheme in the context of achievable rate-equivocation pair 
defined in |Section II| First, if the BP decoder at the destination 
achieves error probability e^, then we have Pr{M =^ M} < 
Ed- Hence, Condition 1 in |Section II| is satisfied if is small 
enough. Second, the uncertainty about the message M at the 
wiretapper given his received sequence Z n is 

H(M\Z n ) 

= H(X n \Z n ) + H(M\Z n ,X n ) - H(X n \M,Z n ) 
= H(X n ) - I{X n ;Z n ) + H(M\Z n ,X n ) - 

H(X n \M,Z n ). (3) 

Based on the memoryless nature of the source-to-wiretapper 
channel and the encoding process, we have I(X n ;Z n ) < 
nC{a(3), H(X n ) = lf\and H(M\Z n ,X n ) < H(M\X n ) = 
0, respectively. Moreover, consider a fictitious receiver at the 
wiretapper trying to decode for X n from observing Z n and 
M, Suppose that the average error probability achieved by this 
receiver is e w . Then we have H(X n \M, Z n ) < 1 + (I — k)e w 
by Fano's inequality. Putting all these back to (|3), we obtain 



-H(M\Z n ) >R C - C{aj3) - (R c - R s )e, 



1 



(4) 



Section II 



Let R e = R c — C{aj3), then Condition 2 in 
satisfied if e w is small enough and n is large enough. Hence, 
(R s ,R e ) is an achievable rate-equivocation pair through the 
BPSK-constrained Gaussian wiretap channel. Moreover, we 
note that the above lower bound is derived from the Fano's 
inequality; thus it applies to any decoder at the fictitious 
receiver. In fact, the value of the bound depends on the choice 
of decoders only through e w . In the next section, we perform 
computer simulation to estimate e w and then employ |4} to 
bound the equivocation rate achieved by the proposed coding 
scheme as described above. To get e w , a BP decoder is 
implemented for the fictitious receiver at the wiretapper. In 
order to provide information about the secret message M to 
the BP decoder, the intrinsic log-likelihood ratios (LLRs) of 
c k are explicitly set to ±oo according to the true bit values. 

3 This is valid when C contains 2 l distinct codewords, which is in turn the 
case with very high probability if C' is chosen randomly in the usual manner 
described in [18]. 



As mentioned in |SectionTl reference [15] uses a systematic 
irregular LDPC code to encode the secret message M (along 
with some random bits) and then punctures the secret message 
bits in the codeword prior to transmission in order to "hide" the 
secret message from the wiretapper. The puncturing pattern is 
designed to minimize the security gap. Such a coding scheme 
can be viewed as an unoptimized special case of our scheme 



proposed in Section III We show in this section that the gen- 



eralization in Section III allows us to systematically optimize 



the irregular LDPC code for good secrecy performance. 

To that end, let us apply the code search process proposed 
in [17] to the present case. Our objective is to design the 
irregular LDPC code C and a puncturing scheme so that the 
secret LDPC code (C, W) works well for both the channel 
from the source to the destination and the channel from the 
source to the wiretapper (given the secret message). Let us first 
consider uniform puncturing of the systematic bits of C, with 
p denoting the corresponding fraction of punctured variable 
nodes. Note that the secret rate R s = j- 2 -. Also, write the 

A l—p ' 

rate of C as R' c = ^. Then R' c — For any fixed R s , 

the discussion just below Q at the end of the previous section 
suggests that we should maximize R c , or equivalently R' c , in 
order to maximize the achievable equivocation rate. 

Express the variable- and check-node degree distribution 
polynomials of C as, respectively, \(x) = X^=2^ a;l ~ 1 an< ^ 
p( x ) = Yli^Pi^^ 1 ' wnere Aj(pi) represents the fraction of 
edges emanating from the variable (check) nodes of degree i 
and d v (d c ) is the maximum variable (check) degree. For a 
fixed value of R s (which in turn fixes p), the design objective 
is to then find X(x) and p(x) that maximize the code rate 



R 1 ,, 



1 



j X ( x j dx subject to the constraint that both Cd and 
e w vanish as the BP decoders iterate. 

Fix p(x), and let ed{t) and e w (£) denote the bit error 
probabilities obtained by the BP decoders at the destination 
and wiretapper, respectively, at the £th density evolution iter- 
ation [12], [19] when an initial A(a;) = Yli=2 ^ iX% ~ 1 ^ s use d- 
Now, let A( j denote the bit error probability obtained at the 
destination by running the density evolution for £ iterations, 
in which X(x) is used as the variable-node degree distribution 
for the first £ — 1 iterations and the variable-node degree 
distribution with a singleton of unit mass at degree j is used 
for the final iteration. Let Bp j denote the similar quantity for 
bit error probability obtained at the wiretapper. Then, we have 

e d(£) = Y,j=2 A e,Ai and = £i=2 B «jV Note that 



the values of Ai j and Bi j are obtained via density evolution. 
To account for the puncturing of c k at the destination's BP 
decoder, the intrinsic LLR distribution entered into the density 
evolution analysis for the destination's BP decoder is set to be 
a mixture of the distribution of the channel outputs at the 
destination and an impulse at with weights determined by 
the value of p. Let e > be a small prescribed error tolerance. 
Suppose that A(x) satisfies the property that ed(Md) < e 
and e w (M w ) < e, for some integers Md and M w . Then, 
we can frame the i? c -maximizing code design problem as the 



TABLE I 

Degree distribution pairs of the rate-0.541, rate-0.508, 
rate-0.505 irregular ldpc codes obtained from the proposed 
code search process. 





rate-0.541 


rate-0.508 


rate-0.505 


A 2 


0.3013 


0.2762 


0.2599 


A 3 


0.1846 


0.2804 


0.2837 


A 4 


0.1510 




0.0281 


Ag 


0.0614 






Aio 


0.3017 


0.4434 


0.4283 


P7 


0.3892 


0.6086 


0.6315 


P8 


0.6054 


0.3914 


0.3532 


PlO 


0.0054 




0.0153 



following linear program: 
A 



max > — ^ subject to: 



J=2 



1, A, > for 2 < i < <L 



<max[0, 6(e s (£ - 1) - e s (t))] 



Y^A^Xj - e s (£) 

d„ 

and V A ltj Xj < e s (l - 1), for 1 < £ < M s 

3=2 



<max[0, 8{e w {l-l)-e w {l))], 



y^^jAj - e w (£) 
i=2 

and ^ /i, . , A , < e w (£ - 1), for 1 < I < M w , 

where d v here is the maximum allowable degree of A (a;) 
and (5 is a small positive number. The solution X(x) of the 
above linear program is then employed as the initial A (a;) 
for the next search round. The search process continues this 
way until ed(Md) or e w (M w ) becomes larger than e, or until 
X(x) converges. We can also fix X(x) and obtain a similar 
linear programming problem for p(x). The iterative search can 
then alternate between the linear programs for X{x) and p(x), 
respectively. 

For illustration, we apply the above code search procedure 
to two different wiretap channel settings: (i) P/a 2 — 3.55 dB 
and a 2 = -4.4 dB, and (ii) P/a 2 = 1.0 dB and a 2 = 
— 1.0 dB. In both cases, the code search process starts with the 
AWGN-optimized LDPC codes reported in [18]. Fig. [2] shows 
the secrecy performance of a rate-0.541 irregular LDPC code 
obtained by performing the code search process with R s = 
0.33 under the first channel setting. The degree distribution 
pair of this irregular LDPC code is shown in |Table I| We 
obtain an instance of the irregular LDPC code by randomly 
generating a bipartite graph which satisfies the two given 
degree distributions. The block length of the LDPC code is 
n = 10 6 , and all length-4 loops are removed. Computer 
simulation is performed on this code to estimate ed and e w 
as described before. The estimated value of e w is employed to 
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Fig. 2. Plot of (R s , R e ) pairs achieved by the proposed coding scheme and 
by the coding scheme in [15] when P/a 2 = 3.55 dB and a 2 = —4.4 dB. 
The solid curve traces the boundary of the capacity-(fractional) equivocation 
region. 



calculate an achievable equivocation rate as in Q, provided 
that ed < 0.01 and e w < 0.01. The resulting achievable pair 
(R s ,R e ) (where R e = |p is the fractional equivocation) is 
plotted against the capacity-(fractional) equivocation region, 
whose boundary is shown by the solid curve in the figure. 
From Fig. |] we see that the pair (R s ,R e ) = (0.33,0.89) 
(shown by the square marker) is achieved by this rate-0.541 
LDPC code. 

Next, we consider the more challenging case under the 
second channel setting, in which the wiretapper's SNR is 
not much weaker than that of the destination. Fig. [3] shows 
the secrecy performance of a rate-0.505 irregular LDPC code 
obtained by performing the code search process described 
above with R s — 0.076. The degree distribution pair of this 
irregular LDPC code can be found in |Table I We observe 
that the pair (R s ,R e ) = (0.076,0.76) (denoted by the square 
marker) is achieved by this code. In conclusion, the code 
search process described above gives irregular LDPC codes 
with relatively good secrecy performance for different values 
of a 2 . A similar code search process can also be formulated to 
include optimization of the puncturing pattern. However, we 
have not been able to obtain significantly better codes with 
the modified search. 

As mentioned before, the codes suggested in [15] are "unop- 
timized" special cases of the coding scheme described here. 
In particular, a rate-0.5 irregular LDPC code with p = 0.3 
is employed in [15], resulting in secret rate R s — 0.43. The 
secrecy performance of the coding scheme in [15] is evaluated 
by the security gap. In our notation, that is to find the values 
j3 and a such that the decoding (bit) error probability of the 
secret message at the destination is smaller than a prescribed 
value, and the decoding (bit) error probability of the secret 
message at the wiretapper is close to 0.5. The security gap is 




R s (bpcu) 

Fig. 3. Plot of the (R s , R e ) pair achieved by the proposed coding scheme 
when P/a 2 = 1.0 dB and a 2 = — 1.0 dB. The solid curve traces the 
boundary of the capacity-(fractional) equivocation region. 

then defined as the ratio of the SNR of the destination to that 
of the wiretapper, i.e. -4-. As reported in [15], the security gap, 
with uniform puncturing over all variable nodes of different 
degree for p = 0.3 is about 4.4 dB. 

To compare with our optimized codes, Fig. [2] shows the 
secrecy performance of the rate-0.5 code in [15] with p = 0.3 
evaluated by using Q as before under channel setting (i). The 
pair (R s , R e ) = (0.43, 0.68) (denoted by the circle marker) is 
achieved by this code. We also perform a code search under 
this channel setting with R s = 0.43 for comparison. The pair 
(R s ,R e ) = (0.43,0.70) (denoted by the diamond marker) 
is achieved using the resulting rate-0.508 irregular LDPC 
code. We see that the irregular LDPC code obtained from the 
proposed code search process also slightly outperforms the 
"unoptimized" one used in [15] in terms of equivocation rate. 

Consulting back to Fig. [T] we see that for a 2 — —4.4 dB, 
the secrecy capacity of the BPSK-constrained Gaussian wire- 
tap channel never exceeds 0.34 bpcu. Hence, the fractional 
equivocation R e is straightly below 1 at R s = 0.43. In fact, 
the highest achievable R e at R s = 0.43 under this channel 
setting is only 0.78 (cf. Fig |2j. That means, we should not 
operate at this rate if we target to achieve perfect secrecy. 
In summary, the proposed coding scheme and code search 
process provide a much more systematic and flexible means 
to designing irregular LDPC codes for the BPSK-constrained 
wiretap channel than the approach in [15]. 

V. Conclusions 

In this paper, we developed a coding scheme for sending 
secret messages over the BPSK-constrained Gaussian wiretap 
channel. The proposed coding scheme employs punctured 
systematic irregular LDPC codes in which secret message 
bits are punctured. To systematically address the secret code 
design problem, we presented a density-evolution based linear 



program to search for good irregular LDPC codes to be used 
in the proposed coding scheme. Simulation results showed 
that the irregular LDPC codes obtained from our search can 
achieve secrecy performance relatively close to the boundary 
of the capacity-equivocation region of the BPSK-constrained 
Gaussian wiretap channel. 
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